Scope of systematization.
In this systematization, we focus on software-only defenses for Spectre attacks.
In particular
we focus on Spectre and not other transient attacks (such as
Meltdown [1]}, LVI [2]},
MDS [3]}, or Foreshadow [4]}), in large part
because most existing work on software-only defenses also focuses on Spectre
attacks—no current tool provides precise detection
of any of the other transient attacks at the software level.
More fundamentally, many of these other attacks can only be addressed
in the hardware, through microcode updates or proprietary changes, making software defenses moot.
We focus on defenses as other works [5]} have
already given excellent overviews of the types of Spectre vulnerabilities and
the powerful capabilities which they give attackers.
And we focus on software-only defenses because they allow us to defend
against today's attacks on today's hardware.
Proposals for hardware defenses are also valuable, but hardware
design cycles (and hardware upgrade cycles) are long; software-only defenses
will continue to play a valuable role for the foreseeable future.
